Alertas de Seguridad de la Información

M Alto vulnerabilidad

08/07/2026

[CVE-2026-55874] SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot…

SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side copy. This issue is fixed in version 4.34.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-54652] Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} end…

Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer role to download Frigate and nginx logs, exposing auto-generated admin passwords and camera credentials logged in request query strings and enabling viewer-to-admin privilege escalation. A fixed release has not been identified.

nvdaltovulnerabilidad CVSS 8.1 NVD

C Alto vulnerabilidad

08/07/2026

[CVE-2026-24700] An OS command injection vulnerability exists in the start_lltd() function of the "rc" binary in Cisc…

An OS command injection vulnerability exists in the start_lltd() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The machine_name configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-49146] App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a…

App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The -B and -C context options accepted any positive integer, and ack sized the before-context buffer to that value, so a project .ackrc setting --before-context=100000000 …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-15067] Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, incl…

Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, including SQL injection via an unsanitized data source input could result in arbitrary SQL execution under the provider's privileged Snowflake session, potentially enabling sensitive data exfiltration and minting of long-lived access credentials. Exploitation requires the ability for an attacker to inf…

nvdaltovulnerabilidad CVSS 8.8 NVD

C Alto vulnerabilidad

08/07/2026

[CVE-2026-24697] An OS command injection vulnerability exists in the start_bonjour() function of the "rc" binary in C…

An OS command injection vulnerability exists in the start_bonjour() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The wan_hostname configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.

nvdaltovulnerabilidad CVSS 7.2 NVD

C Alto vulnerabilidad

08/07/2026

[CVE-2026-24698] An OS command injection vulnerability exists in the save_syslog_to_file() function of the "httpd" bi…

An OS command injection vulnerability exists in the save_syslog_to_file() function of the "httpd" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The model_name configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.

nvdaltovulnerabilidad CVSS 7.2 NVD

C Alto vulnerabilidad

08/07/2026

[CVE-2026-24699] An OS command injection vulnerability exists in the sub_34984() function of the "rc" binary in Cisco…

An OS command injection vulnerability exists in the sub_34984() function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The lan_ipv6_prefixlen configuration parameter is not properly sanitized, which could allow an authenticated remote attacker to execute arbitrary OS commands with root privileges.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-10706] In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and c…

In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user behavior across multiple applications via dbId enumeration. The platform does not implement data minimization, privacy by design, or implement appropriate technical safeguards, allowing sensitive information to be exposed to unauthorized parties.

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

08/07/2026

CVE-2026-0279 PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities

Palo Alto Networks PSIRT publica advisory de seguridad: CVE-2026-0279 PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities (Severity: LOW). Tipo: Cross-Site Scripting (XSS). Producto afectado: PAN-OS.

firewallngfwpan-os PAN PSIRT

M Alto vulnerabilidad

08/07/2026

[CVE-2026-58656] Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and respo…

Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *, allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token from access logs, proxy logs, browser history, or Referrer headers can create persistent backdoor supe…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

08/07/2026

[CVE-2026-59257] n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerabil…

n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated {{ ... }} expression values directly into the raw SQL string without parameterization. When a workflow uses this operation with expression-sourced values and is connected to an externally-reachable trigger …

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

08/07/2026

[CVE-2026-56776] n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{wor…

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a workflow can trigger a real evaluation test run, causing the workflow to execute via the internal workflow runner and resulting in unin…

nvdaltovulnerabilidad CVSS 7.4 NVD

F Alto vulnerabilidad

08/07/2026

[CVE-2026-56297] FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_cal…

FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-56226] Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(…

Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which is SECURITY DEFINER and granted to the anon role, allowing unauthenticated access. Because the function accepts a caller-supplied user UUID without verifying it matches the authenticated user, an attacker using only the public publishable API key can query POST /rest/v1/rpc/get_o…

nvdaltovulnerabilidad CVSS 7.5 NVD

D Alto vulnerabilidad

08/07/2026

[CVE-2026-56086] Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through…

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

nvdaltovulnerabilidad CVSS 8.8 NVD

D Alto vulnerabilidad

08/07/2026

[CVE-2026-53482] Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through…

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an Integer overflow or wraparound vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

D Alto vulnerabilidad

08/07/2026

[CVE-2026-41122] Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through…

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain a stored cross-site scripting vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability. Exploitation may lead to information disc…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-6820] The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Sc…

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-6818] The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Sc…

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special_requests' parameter in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pa…

nvdaltovulnerabilidad CVSS 7.2 NVD